CVE-2025-7031
📋 TL;DR
This vulnerability allows unauthenticated attackers to access configuration pages in Drupal that should require authentication. It affects Drupal sites using the Config Pages Viewer module versions before 1.0.4.
💻 Affected Systems
- Drupal Config Pages Viewer module
📦 What is this software?
Config Pages Viewer by Config Pages Viewer Project
⚠️ Risk & Real-World Impact
Worst Case
Attackers could view sensitive configuration data, modify site settings, or escalate privileges by accessing administrative interfaces.
Likely Case
Unauthorized viewing of configuration pages containing sensitive information like API keys, database credentials, or site settings.
If Mitigated
Limited to information disclosure if proper network segmentation and access controls are implemented.
🎯 Exploit Status
Exploitation requires direct access to vulnerable endpoints; no authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.0.4
Vendor Advisory: https://www.drupal.org/sa-contrib-2025-086
Restart Required: No
Instructions:
1. Update the Config Pages Viewer module to version 1.0.4 via Drupal's update manager or Composer. 2. Clear Drupal caches after update.
🔧 Temporary Workarounds
Disable Config Pages Viewer module
linuxTemporarily disable the vulnerable module until patching is possible
drush pm:disable config_pages_viewer
Restrict access via .htaccess
allBlock access to config pages viewer paths at web server level
# Add to .htaccess: RedirectMatch 403 ^/config-pages-viewer
🧯 If You Can't Patch
- Implement strict network access controls to limit who can reach the Drupal instance
- Enable detailed logging and monitoring for unauthorized access attempts to config pages
🔍 How to Verify
Check if Vulnerable:
Check Drupal's module list for Config Pages Viewer version; if version is 1.0.3 or lower, system is vulnerable.Check Version:
drush pm:list | grep config_pages_viewerVerify Fix Applied:
Confirm Config Pages Viewer module version is 1.0.4 or higher in Drupal's module administration page.📡 Detection & Monitoring
Log Indicators:
- Unauthenticated requests to /config-pages-viewer paths in web server logs
- 403 or 404 errors from config pages in Drupal logs
Network Indicators:
- Unusual traffic patterns to config-related endpoints from unauthenticated sources
SIEM Query:
source="web_server_logs" AND uri="/config-pages-viewer*" AND status=200 AND auth="-"